diff options
author | imp <imp@FreeBSD.org> | 1997-02-09 05:04:17 +0000 |
---|---|---|
committer | imp <imp@FreeBSD.org> | 1997-02-09 05:04:17 +0000 |
commit | 0bd4c187acf470a3fb00c2633c8b9e4f3d46cfaf (patch) | |
tree | f0629af2bbe07ee14c70887394ad01052c1a573b /usr.sbin/lpr/lpc | |
parent | 03062e7af3f104a9fc3f25ee7fbf91fe2a58058b (diff) | |
download | FreeBSD-src-0bd4c187acf470a3fb00c2633c8b9e4f3d46cfaf.zip FreeBSD-src-0bd4c187acf470a3fb00c2633c8b9e4f3d46cfaf.tar.gz |
Buffer overflow from OpenBSD:
Rev 1.7 millert:
possible oflow
Obtained from: OpenBSD
Diffstat (limited to 'usr.sbin/lpr/lpc')
-rw-r--r-- | usr.sbin/lpr/lpc/cmds.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/usr.sbin/lpr/lpc/cmds.c b/usr.sbin/lpr/lpc/cmds.c index 722e81b..51e269e 100644 --- a/usr.sbin/lpr/lpc/cmds.c +++ b/usr.sbin/lpr/lpc/cmds.c @@ -329,7 +329,8 @@ cleanpr() n++; } if (n == 0) { - strcpy(lp, cp); + strncpy(lp, cp, sizeof(line) - strlen(line) - 1); + line[sizeof(line) - 1] = '\0'; unlinkf(line); } } else { @@ -338,7 +339,8 @@ cleanpr() * been skipped above) or a tf file (which can always * be removed). */ - strcpy(lp, cp); + strncpy(lp, cp, sizeof(line) - strlen(line) - 1); + line[sizeof(line) - 1] = '\0'; unlinkf(line); } } while (++i < nitems); |